Couchu

Privacy policy

Draft — pending legal review

Last updated:

This policy explains which personal data Couchu (the iPhone and Android app and the couchu.app website) processes, why, for how long and what rights you have. It is written to be read: if anything is unclear, write to us.

1. Data controller

The controller is Luca Santonastasi, Via Venturini 4, 40126 Bologna, Italy (VAT number pending), which runs Couchu. No data protection officer (DPO) has been appointed, as the conditions of Art. 37 GDPR do not apply. For any privacy request: [email protected].

2. In short

  • We ask for neither your email nor your name: on first launch the app creates an anonymous account identified by a random code.
  • On the server we keep what we need to give you recommendations across phones: watched titles, ratings and your "To watch" list.
  • The requests you type are used to answer and are not stored for any other purpose. Your conversation history stays on your phone; if you link Apple or Google we also save it on your account, encrypted, so you find it on your other phones.
  • On the free plan ads marked as such among the recommendations, in lists and at the bottom of some screens, and sometimes a full-screen one when you close a page, a match or a deck; rewarded videos only when you ask; always after your consent choices. No ads with Premium. Usage statistics only if you turn them on.
  • Once there are many users, everyone's ratings are also used, in aggregate form and without account codes, to work out which titles people like together; you can object with a switch in Settings (section 3.2).
  • You can export your data and delete your account at any time in the app.

3. What we process, why and on what legal basis

The legal bases are those of Article 6 of Regulation (EU) 2016/679 ("GDPR"): contract (Art. 6(1)(b): providing the service you ask for by using the app), consent (Art. 6(1)(a)), legal obligation (Art. 6(1)(c)) and legitimate interest (Art. 6(1)(f)).

3.1 Anonymous account

On first launch the app asks the server for a new account: a random identifier (the account code shown in Settings) and an access token kept in the phone's secure keychain; on the server the token is stored only as a cryptographic fingerprint (hash). We also record the creation date and the last day of use. Basis: contract.

3.2 Watched titles, ratings and "To watch"

The titles you mark as watched, with the optional rating, the date and, for series, the last season you watched, and those saved to "To watch" are synced with the server, so you do not lose them when you change phone, recommendations skip what you have already seen, Couchu points out new seasons and new episodes of the series you follow and the advice on which subscription suits you (Premium) uses them to count the titles on each service; the advice computed is kept on the server for 6 hours, tied to your account, country, services and day, so we do not work it out again every time you open it; then it is deleted (at the latest by the following night's cleanup) and, while it exists, it is included in the data export. We also count, anonymously, how many pieces of advice we compute each day. When a new season or episode of a series you watched comes out on one of your services, the server reopens it: in your watched records we note that it was reopened, with the new season or episode and the date, and the series appears in "To watch" keeping your rating. We send no new data to third parties for this. Basis: contract.

Recommendations from similar tastes. Once there are many users, we use everyone's ratings, in aggregate form, to work out which titles people like together ("people who loved X also loved Y"). Every night the server computes, from the 1 to 5 ratings, a list of pairs of titles; a pair is included only if at least 25 different people have rated both titles, and the list contains no account codes or any other data about who rated them. That list is used to rank everyone's recommendations, including yours. We do not use titles watched without a rating, your requests, "To watch" or "Dislike", and we do not infer from ratings anything about health, religion, sexual orientation or other special categories of data. Basis: legitimate interest (Art. 6(1)(f) GDPR) in improving recommendations for all users, which we have balanced against your rights: the computation starts only once there are many ratings, and its results are not about people. You can object at any time by turning off Settings › Privacy and data › What you share › "Use my ratings for everyone's recommendations": from the following night your ratings are no longer included in the computation, and your recommendations keep working.

The titles you said you do not want ("Dislike" or "Not interested", from the cards or the title page) are stored on the server and synced across your phones, with the type of signal and the date. They are used not to suggest them again and, for "Dislike", to lower similar titles in recommendations; they stay until you restore them from Settings › What you watch › "Excluded" or delete the account, and they are included in the export of your data. We count, anonymously and without your account code, how often each action is used. We send no new data to third parties for this. Basis: contract.

Board games. If you use the board games mode, the games you mark as "We have it", "Played" or "To try", with the optional rating, are synchronised with the server like your watched titles, so your collection is on every phone and the suggestions can stick to the games you own. Game details come from Wikidata, Wikipedia and Wikimedia Commons and contain no data about you. Basis: contract.

If you import your collection from BoardGameGeek, you download your collection file from boardgamegeek.com yourself and choose it on your phone. The file is read only once, first on the phone and then by our server, just to recognise the games by their BoardGameGeek number: we do not keep it and we do not write its content to any log, on the phone or on our servers. Only the games you add to your collection remain, with "We have it", "Played" or "To try" and your rating. We store no other BoardGameGeek data. Basis: contract.

Video games. If you use the video games mode, we save the platforms you play on (for example PC, PS5 or Switch) and, if you add them, the game subscriptions you have (for example Game Pass): they stay on your phone and, with the account linked to Apple or Google, among the account's preferences (section 3.3.1). When you ask for a video game we send the server, along with the request, the platforms and the filters you chose, so the suggestions only include games you can play. The video games you mark as "I own it", "Played" or "To try", with the optional rating, join the same collection as the board games and are synchronised the same way. Game details come from Wikidata and Wikipedia and contain no data about you. Basis: contract.

Prices and shops. For PC games we show the current prices in your country provided by IsThereAnyDeal, exactly as they arrive, and the subscriptions that include the game: our server fetches them every night for the whole catalog, without sending any data about you. Couchu sells no games and is not affiliated with the shops. If you tap a price or "Open on…", the shop's website opens (the link may go through IsThereAnyDeal): from there that site's rules apply, and it receives your IP address as for any page you open. Basis: contract.

If you import your Steam library, you enter your Steam profile link, custom name or SteamID in the app. Our server uses it only once: it asks Steam (Valve) which profile matches the name and which games you own, with the playtime, used only to mark as "Played" those with more than two hours; for this the profile's game details must be public, and you can set them back afterwards. We do not keep the SteamID and we do not write it to any log, on the phone or on our servers; Steam receives our server's request, not your IP address. Only the games you add to your collection remain, with "I own it" and "Played". We store no other Steam data. Basis: contract.

With Premium you can organise watched titles and "To watch" into personal lists: we store the name you give each list and which titles it holds, to sync them across your phones. List names never go into recommendations, logs, statistics or admin tools; if Premium ends they stay stored but hidden until you renew. Basis: contract.

If you import your tastes from an IMDb, Letterboxd or Netflix file you downloaded yourself, the server reads the file only to recognise the titles and then discards it: we do not store it and we do not write its contents to the logs. The server receives at most the first 5,000 rows; a Netflix history, which has one row per episode, is first reduced on the phone to one row per film or series. On the phone the temporary copy is deleted right after reading. Only the titles you choose to add to your watched list remain, with the rating and date from the file. Basis: contract.

If you link Trakt (Settings › Account and plan › “Link Trakt”), you type on trakt.tv a code the app shows you: Trakt gives our server a read authorisation, which we store encrypted (with its expiry and the date of the last update) and which never reaches the phone, the logs or the data export. With it the server reads from Trakt your watch history, ratings and watchlist, matches them to our catalogue through the IMDb ID and adds to your watched list and to "To watch" only what is missing (a rating or a title you already have in Couchu does not change); then, every night, it reads only what is new. We never write anything to Trakt. “Unlink Trakt” deletes the authorisation and the link at once; the titles already imported stay in your watched list until you remove them. For your Trakt account, Trakt is an independent controller. Basis: contract.

3.3 Sign in with Apple or Google (optional)

If you link your account to Apple or Google, we receive a signed token from them and keep only the provider identifier (the sub field): never your email or name, and the Google picture only as explained below ("Google account photo"). It lets you recover your data on another phone. You can unlink it in Settings; the account stays anonymous with its data. When you link Apple we also keep, encrypted, a token issued by Apple that we use only to revoke the access when you unlink or delete the account; Apple can also notify us if you stop using your Apple ID with Couchu, in which case we unlink it. So that the same Apple or Google token cannot be used twice, we keep only a cryptographic fingerprint of it (SHA-256), with the account code, until the token itself expires (a few hours at most); the nightly cleanup deletes it. Basis: contract. For sign-in, Apple and Google are independent controllers of your account data with them.

3.3.1 Preferences and conversations on the linked account

Only while the account is linked to Apple or Google, we save on the server, so you find them on every linked phone:

  • your preferences: country, services, language, theme, audio and subtitle languages, what you are into and, if you use video games, the platforms you play on and your game subscriptions;
  • your conversation history: the last 100, with the messages you wrote, the answers and the filters.

Conversations are encrypted with a key kept only on our servers: they cannot be read in the database, and we use them for nothing else, not even for statistics or to train models.

When you link a new phone to an account that already exists, the phone takes the account's preferences and the conversations of both are merged.

Consent choices, alerts and "Group night" guests stay on the phone instead. If you unlink the last provider, we delete preferences and conversations from the server; they stay on the phone.

Basis: contract.

3.4 Recommendation requests and title search

When you ask for a recommendation we send the server the text you type, the filters you chose (type, mood, genres, company, time, notes), the country, your services and the language; together with the previous messages of the same conversation (yours and Couchu's answers), so you can refine the request. The server adds a taste profile computed from your watched titles and ratings and from the weak signals of “Refine your taste” (“I want to watch it” and “I like it, but I'll pass”) (up to 8 loved titles and 5 to avoid, without your account code). We keep these signals on the server, one per title, until you delete your account or a newer signal replaces it, and they are included in the data export. To choose and explain the titles we use artificial intelligence models on Amazon Bedrock in the European Union (region eu-south-1, Milan, and other AWS regions in the EU for load balancing). Amazon does not use this data to train the models and does not share it with their developers.

“Your taste” shows you the same profile computed from your ratings (the genres, directors, actors, decades and languages you love or avoid): we compute it when you open the screen and keep it only in the server's working memory, never in the database. With Premium, the groups of titles you love get a short name written by an artificial intelligence model on Amazon Bedrock in the EU, from the titles and their genres only, without any personal data of yours; the app says when a name is written by AI. Basis: contract.

“Your year on Couchu” (from 1 December to 15 January): when you open the screen, the server computes the year's numbers from your watched titles and ratings (titles watched, estimated hours, genres, top-rated titles, most used service, series finished, matches won). With at least 10 titles watched, an artificial intelligence model on Amazon Bedrock in the EU writes one sentence from the numbers, genres, titles and service only, without your name or account code; the sentence, with the numbers it was written from, is kept per year and language (so we do not write it again at every visit), is included in the data export and is deleted with the account. The image to share is made on the phone and contains numbers, genres, titles and a service, never your friends' names; you share it yourself, wherever you like. Basis: contract.

“What I remember”: when a request states a preference that always holds (for example “no more anime” or “never horror”), Couchu offers “I'll remember: …” below the answer. Only if you tap “OK” do we save the rule on the server: its kind (genre, theme, maximum length, audio, film or series, language), its value, the date and whether you added it from the chat or by hand; the request text is not saved. Rules apply to later recommendations until you remove them: you can see and delete them in Your taste › “What I remember”, they are included in the data export and they are deleted with the account. Basis: contract.

The text of your requests is not stored to answer them: we do not save it with the recommendation data and do not write it to logs. The only exception is the conversation history on the linked account, encrypted (section 3.3.1). An identical answer stays in a temporary cache for 10 minutes, found through a cryptographic fingerprint of the request, and is deleted at the latest by the following night's cleanup. So as not to repeat the same work, the server also keeps for one hour, only in its working memory (never in the database or the logs), the model's interpretation of the request (for example genres, people or titles mentioned, exclusions) and its numeric representation used for the search, found through a cryptographic fingerprint and not through the text; they are also lost whenever the server restarts; the technical statistics about answers (model, timings, cost, number and codes of the proposed titles) contain neither the text, nor your account code, nor a fingerprint of the request. The names of "Group night" guests stay on the phone: the server receives only the titles they love. Even so, we recommend not writing personal data about yourself or others in the notes. The text you search when adding a title is used only for the search and is not stored; if our catalogue finds few results, we also send it to the search service of Wikidata (Wikimedia Foundation, United States), without any identifier of yours. Basis: contract.

“Search by plot”: when you describe a title you cannot remember, we send the sentence to the server, which turns it into a numerical representation with Cohere Embed and asks an Amazon Nova model to choose the best matching titles, both on Amazon Bedrock in the European Union, without your account code. The sentence is not stored: for 7 days we keep only the results in a cache, found through a cryptographic fingerprint of the sentence (together with country and language), and for 2 days the number of plot searches made that day, to apply the daily limit. “Plan the weekend” is a recommendation request like any other: the time you choose for Saturday and Sunday is used only to answer. Basis: contract.

“Which title is it?”: when you share a link, a text or a screenshot to Couchu (for example one a friend sent you), the server looks for the titles in our catalogue. Of a link it reads only the address (the IMDb ID, the name in a Letterboxd address, the words of the path) and never opens the page; of a text, only the words. A screenshot, reduced on the phone (at most 1024 pixels and 1 MB), is sent to a Claude model on Amazon Bedrock in the European Union that reads titles and years from it, without your account code: the image is not stored, not written to the logs and not used to train models. Links, texts and images are not stored; to apply the daily limit on screenshots we count for 2 days how many you sent. We advise you not to share screenshots containing personal data about you or others. Basis: contract.

“What we can't find”: to learn what the catalogue is missing, when an answer finds few titles we keep for 30 days only the structured criteria understood from the request (genres, years, language, length, people and titles mentioned as catalogue codes), with country and plan, without the text and without any link to you. Once a week an artificial intelligence model on Amazon Bedrock in the EU turns them into a summary for us. Basis: legitimate interest in improving the service.

Answers, explanations and synopses marked as automatically generated are written by an artificial intelligence system, and the app says so in the conversation (Regulation (EU) 2024/1689, Art. 50). When the models are unavailable or the daily spending limit has been reached, the answer is simplified, the app says so and the search is not counted.

“Refine your taste”: when you close a deck, the app sends, for each card, the answers you gave and the time you took to answer. The server uses them to discard answers given in quick bursts and to award the day's gifted Couchu Coin; for each deck it keeps only the counts (valid answers, discarded answers and the Coin outcome) for 30 days, so the same Coin is not awarded twice. Basis: contract.

3.5 Searches, subscription and purchased searches

To apply the plans' limits (per day in the first week, then over the last 7 days) we count each day's searches, the quick replies not counted, the rewarded videos watched, the unlocks obtained with videos and the balance of purchased searches, and we use the account's creation date. The Premium subscription and extra searches are bought through the App Store or Google Play and managed with RevenueCat, which receives your random account code as an identifier (its SDK in the app also sends technical device data such as model, system, language and IP address) and records the purchase history (product, price and currency, dates, store transaction identifiers). We receive the subscription status and the transactions from RevenueCat and use them to activate Premium and to credit searches exactly once. We never see payment details: Apple and Google process them, selling the subscriptions as independent controllers. Basis: contract; after account deletion, legal obligation (see section 5).

We also keep the balance of the Couchu Coins the app has given you (for "Refine your taste" and for rewarded videos) and the register of those gifts (day and kind) until you delete your account. Gifted Coins are not purchases and do not extend the retention reserved for purchased Coins.

Coins between friends. When you gift Couchu Coins to a friend, or ask them for one, we save who sends and who receives, how many, when, how many came from gifted and how many from purchased Coins (needed if the store refunds a purchase), the message chosen from a fixed list (never free text) and, for requests, their status (open, answered, declined, withdrawn or expired: a request expires after 24 hours). If a store refunds a pack you had partly gifted, we also keep any Coin debt. Your friend sees your name with the request or the gift and, if they allowed it, gets a notification (the "Friends and lists" switch); in "Sent and received" each of you sees the last 90 days. If one of you deletes the account, the row stays with the other person, showing "Deleted account" instead of the name, with no link left to the deleted account. We keep transfers and requests for 400 days, for the daily limits, the history and store refunds. Basis: contract.

3.6 Ads and rewarded videos (Google AdMob)

On the free plan the app shows ads marked "Ad": one among the recommendations, a banner under the cards of the last answer and in each title and game page, ads in lists (Search, Platforms, friends' activity, history, Coming soon) and banners at the bottom of some read-only screens (for example Your month, Your taste, Your matches); never in "Watchlist", in shared lists, in the settings or while you vote. Sometimes, when you close a title or game page, a match result or the "Refine your taste" summary, a full-screen ad appears: never in the first 7 days after sign-up, at most 4 a day, at least 4 minutes apart and never right after opening the app from a notification or a link. An ad video plays only when you ask for one: to get a gifted Couchu Coin (at most 3 a day) or to unlock a feature shown in the app for a limited time; after each video watched to the end, you see no ads for an hour. No ads with Premium. At the end of setup if you choose "Continue", and then when the app starts while you are on the free plan, we ask for your choices with Google's consent form (UMP) when needed and, on iPhone, with Apple's tracking prompt (ATT) if you have not answered it yet; without a consent that allows it we request no ads. Google's component starts only when it has to show the first ad. Ads are limited to content suitable for ages 13 and up. Google AdMob may process device identifiers (the advertising ID only if you allow it), the IP address and the approximate location derived from it, and data about your interaction with the ad; with your consent, ads may be personalised. To credit a video's reward we give Google your random account code and, for an unlock video, the kind of unlock, which Google sends back to us with a signed confirmation. Watched titles, ratings and requests never go to advertisers: ads do not depend on what you asked for or on the titles you open. Basis: consent for personalised advertising and for access to device data; you can change your choices in Settings › Privacy and data › Ad consent. Google is an independent controller of the data processed for advertising (how Google uses data).

3.7 Push notifications (series alerts, Premium alerts, monthly summary, evening notification and app news)

With two separate switches you can turn on alerts about new seasons and new episodes of the series you follow (those you watched, rated at least 3 stars or not rated, or that are in "To watch"), available to everyone, and alerts (Premium) about titles in your "To watch" list arriving on or leaving your services. We store the phone's notification token, the system (iOS or Android), the country, your services and the language, and we record which alerts we sent (for series, the season and episode too) so we do not repeat them, and which kinds of alert you have on. With arrival and departure alerts (Premium) you also get, on the first of each month, the "Your month on Couchu" summary with the advice on which subscriptions to keep, pause or try, worked out from your "To watch" list and your ratings as on the "Your month" screen; we record the month we sent it so we do not repeat it, and if there is no advice we do not write to you. If Premium ends, arrival and departure alerts stop and are removed from the subscription after 30 days (if you renew earlier, they resume); series alerts stay for as long as you leave them on, and the subscription is deleted only when none is left. Alerts go out once a day, from 9 am (Italian time), never at night. Notifications go through Expo's push service and then Apple or Google. For each notification sent we keep the identifier of Expo's receipt with the account code until we read the delivery outcome (2 days at most): it is used only to remove phones that no longer exist and contains neither the text nor the token. If Expo tells us a phone is no longer registered, we remove its token from every subscription at once (alerts, evening notification, matches, friends and lists, app news). Basis: consent (the system permission and the switch in Settings), which you can withdraw by turning the switch off.

Trailers. To find trailers, every night our server searches the YouTube Data API (Google) for the title and year of the catalogue's films and series: it sends no data of yours. We keep only the video's identifier and the date of the last check, and check it again at least every 30 days. In the app the trailer loads from youtube-nocookie.com only when you start it: before the tap no request reaches Google. From then on YouTube receives the IP address and device data as an independent controller, and the YouTube Terms of Service and the Google Privacy Policy apply. Basis: contract (you start it).

If you turn on the evening notification (also without Premium), we store the phone's notification token, the system, the country, your services, the language, the time you chose and your phone's time zone (the notification arrives at that time in your time zone), and we record the day we sent it so we never repeat it. The three "Tonight for you" titles are worked out from the same data as the recommendations (services, country, language, ratings) and kept for 7 days so they are not suggested again. Basis: consent (the system permission and the switch in Settings), which you can withdraw by turning the switch off: the subscription is deleted at once.

New titles to browse. With the evening notification on, on Friday evening (in the same window as the evening notification) you receive instead a notification when at least 8 titles you have not rated arrived on your services that week: it opens “Refine your taste” with those titles. On 1 December, again instead of the evening notification, if you watched at least 10 titles in the year a notification announces “Your year on Couchu”. We record the day and type of notification sent so as to send at most one of these (or one evening notification) a day; the record is deleted after 60 days. Basis: consent, which you withdraw with the “New titles to browse” switch (Settings › Notifications) for the Friday one, or by turning off the evening notification for both.

App news. When we publish a new version of the app we send you a notification ("Couchu has been updated"), at most one every 3 days, only between 9 am and 10 pm (Italian time). If the phone already allows notifications, the "App news" switch (Settings › Notifications › For you) is on and the app registers the notification token, the system and the language by itself; otherwise you turn it on and the system asks for the permission. The notification goes to the most recent phone among those you gave us for the other notifications. We record which update we announced to you, when, and whether the notification went out, so we do not repeat it and keep to the 3 days; the record is deleted after 90 days. The notification contains none of your data. Basis: consent (the system permission and the switch), which you can withdraw by turning the switch off: the notifications stop for your account, on every phone, and the token registered for them is deleted.

Progress. If you turn on the "Progress" switch (Settings › Notifications › For you), which stays off until you turn it on, on Sunday evening (from 6 pm, in your phone's time zone) we send you at most one notification when a single goal stands between you and a successful week, never on a day when another discovery, evening or alert notification went out. We save your phone's notification token, its system type and language, and we record the day we sent it in the same log as "New titles to browse" (60 days). Basis: consent, which you withdraw by turning the switch off.

3.8 Guest poll and "Match for two"

If you create a poll (Premium), we store the proposed titles, the country, the language and the creation, expiry and closing dates, linked to your account. People who open the link vote in the browser without the app or an account: we store the chosen titles, the optional name (up to 30 characters, visible only to the poll's creator) and a random voter identifier generated by the browser, kept on the server only as a hash. To limit votes from the same network we store a fingerprint of the IP address (or its network) computed with a secret key that changes at every server restart: it cannot be traced back to the address. The poll page saves that identifier, the choices and the name in the browser's local storage (localStorage) only so you can change your vote: it is strictly necessary for the service you request and it is not a profiling cookie. The poll closes after 48 hours (or earlier, if its creator closes it) and is deleted 7 days after it expires. Anyone with the link can see the titles and vote counts. Basis: contract.

"Match for two" works the same way: we store the titles of the answer it starts from (or the ones you pick), the country, the language and the dates, linked to your account; whoever opens the link votes from the browser without an account, and we store only the titles they said "yes" to, whether they have finished and the name they may choose to write. Your vote is recorded with an identifier derived from your account. The match expires after 24 hours. Whoever created it and whoever received it in the app find it in “Match for two” for 7 days after it expires, then it is deleted. If you chose a title, after those 7 days we delete the votes and the other titles and keep only the chosen title, who took part and the dates, for 90 days after it expired: that is the “You chose” section. Basis: contract.

Match notifications. When you create a match, open one sent to you or link a partner, and the phone already allows notifications (or you allow them by tapping "Notify me"), we store the phone's notification token, the type of system and the language, to tell you when the other person has voted, when it's a match or when you have no title in common: at most one notification of each kind per match. The notification may contain the name the other person wrote and the title of the match. We record which notifications we sent so as not to repeat them; the record is deleted with the match. The same token is also used for friends and shared lists notifications. Basis: consent (the system permission and the "Match for two" switch in Settings), which you can withdraw by turning the switch off: match notifications stop at once, and the token is deleted when friends and lists notifications are off too (and vice versa). An hour before a match you have not finished expires, we also send you a reminder (never between 10 pm and 8 am).

Home partner. If you link a partner (an Apple or Google account is needed), we store the name you choose (your first name only, at most 30 characters: Apple or Google may suggest it, but you confirm or change it; never the email), the link between the two accounts and, until it is used or expires after 48 hours, the invite code. Your partner sees your name and you see theirs; the matches you send each other are voted in the app, and whoever receives one sees the result and their own vote, not the others' "yes". You can unlink at any time from Settings: the link is deleted at once for both of you, and it is also deleted when you delete your account. Basis: contract.

“Just us two” and your partner's ratings. With “Just us two” the person asking for a recommendation also uses their partner's taste: the server adds to the request, sent to the artificial intelligence model on Amazon Bedrock in the EU, the 5 most recent titles the partner loved and those they rated low, calling them only “Partner”, never by name or account code. We do this only after the partner says yes: until they answer, or if they say no, their ratings are not used. Whoever wants to use the other's ratings sends them a request (a row in Tonight and in Home partner and, if allowed, a notification); we store each person's answer (yes, no or no answer) and the date of the last request. The partner can change their mind at any time with the “Use my ratings for «Just us two»” switch in Settings › Partner and friends › Home partner, and the choice applies from the next request; linking or unlinking a partner resets the answers. The person receiving the recommendations sees the chosen titles, not the partner's ratings. Basis: the partner's consent (Art. 6(1)(a) GDPR), which they can withdraw with the same switch; for the person asking, contract.

Friends. If you link up with a friend through a code (an Apple or Google account and a name are needed), we store the link between the two accounts and, for 48 hours or up to 10 uses, your invite code. Your home partner becomes a friend too. Your friends see your name, the titles you mark as watched in the app with their stars and the ones you add to your Watchlist in the last 30 days; they do not see your searches, conversations, titles imported from other services, titles rated in the onboarding or in the "Refine your taste" deck, the titles you excluded or your personal lists. With the "Share my activity" switch (Settings › Partner and friends) you stop showing it, and you also stop seeing the others'. You can remove a friend at any time: the link is deleted at once for both. When someone accepts your invitation we send you a notification, if you allowed it. So that others never see your account identifier, friends see you through a code derived from it with a secret key. You can send a Match for two to a friend: they get your name with the match, vote in the app and you both get the result. Under a recommendation the app may write “… loves it” with the name of at most two friends who gave that title 4 or 5 stars from the app: only if you both share your activity, under the same rules as above (no imported titles, onboarding or deck titles), and without storing it with the recommendation. Invitations for partners, friends and lists can also be sent as a couchu.app/l/… link: the website page reads only the type of invitation from the link and receives no names. Basis: contract.

Shared lists. If you create a shared list or join one (with a code valid for 7 days, or because a friend adds you), we store the list's name, who is in it and since when, the titles with who added them and the hearts. Everyone in the list sees the list's name, the members' names, the titles, who added them and the hearts; nothing else about you. If you leave, the titles you added stay in the list without your name and your hearts are deleted; if the person who created it leaves or deletes their account, the list passes to whoever joined first, and it is deleted when the last person leaves. We notify you when someone adds you to a list, when someone joins one of your lists and when titles are added (at most once every 3 hours per list, never between 10 pm and 8 am, Italian time: they wait until 8 am), if you allowed notifications; the "Friends and lists" switch in Settings turns them off. While one of these notifications is waiting to go out we keep the name of the person who caused it, the list and the title; we delete it one day after it is sent, or earlier together with the account of the person who receives it or of the person who caused it. A list can hold films and series, board games or video games: the same applies to games. Basis: contract.

Google account photo. If you link a Google account, at every sign-in we store the address of the profile photo Google gives us (Apple gives none, so we ask nothing of those who only use Apple). We show it to your friends, to the people in your shared lists and in matches only after you chose "Show the photo", when the app asks you or with "Show my Google account photo" (Settings › Partner and friends); until you answer they only see your initial. If you choose "Use my initial", or turn the switch off, we delete the stored address and stop storing it at later sign-ins; if you change your mind, the photo comes back at your next Google sign-in. The image is loaded from Google's servers, which therefore receive the IP address of whoever views it. It is also deleted with the account. Basis: consent, which you can withdraw at any time with the same switch.

3.9 Crash reports (Sentry)

Only if the app crashes or hits an error we send Sentry (organisation in the European Union) a technical report (error type, place in the code, phone model, system and app version) without your account code, typed text, request bodies, search parameters or screenshots; we send no performance measurements or session data, and Sentry does not store the IP address. Basis: legitimate interest in fixing errors; reading this data from the phone is strictly necessary to provide the service you request (Art. 122 of the Italian Privacy Code).

3.10 Usage statistics (PostHog, only with consent)

Usage stats are off until you turn them on in Settings. If you do, we send PostHog (servers in the European Union) fixed events made of codes, numbers and yes/no values, plus the technical data its SDK adds (phone model, system, app version, language), linked to a random identifier different from your account code: never text, titles or data that identify you directly. This data is pseudonymous, not anonymous: we do not link it to your account, and we turn off geolocation and session recording. Basis: consent, which you can withdraw by turning the switch off.

3.11 Security and technical logs

Like any online service, our servers and Cloudflare receive your device's IP address to deliver content and protect it from abuse: we use it to limit the number of requests, of new accounts (for 24 hours at most) and of poll votes. Server logs contain no email addresses, full IP addresses, request texts or other data that identify you. Basis: legitimate interest in the security of the service.

3.12 App integrity check

To protect the service from modified apps and automated requests, when you create the account, link it to Apple or Google and ask for a recommendation the app attaches a proof signed by the phone's system: Apple's App Attest on iPhone, Google's Play Integrity on Android. On Android the proof is verified with Google's service; on iPhone we keep the public key generated by the phone for this installation, with its creation and last-use dates. The proofs contain neither your name nor your Apple or Google account. Basis: legitimate interest in the security of the service; it is strictly necessary to provide it securely (Art. 122 of the Italian Privacy Code).

3.13 App updates and posters

At launch the app checks for an update with Expo's update service, which receives the IP address, the system, the app version and a random installation identifier. Posters and service logos load from the servers of Movie of the Night, the provider of the Streaming Availability API, which receives the phone's IP address (or the browser's, on the poll page) as with any image downloaded from the Internet; it does not receive your account code. Basis: legitimate interest in running and updating the app.

3.14 Website and beta signup

The website uses no profiling cookies, no analytics and no advertising. Cloudflare, which protects the website, may set technical cookies (for example __cf_bm) to tell people from bots: they are strictly necessary and need no consent. If you sign up for the beta we keep your email address, the page language and the date of your consent, and we use them only to write to you about the beta and the launch. We have not sent any email so far; when we do, each one will have an unsubscribe link. Basis: consent, which you can withdraw at any time by writing to us; withdrawal does not affect processing carried out before it.

3.15 Progress, badges and surprises

For the weekly goals, the streak, points, levels and badges ("Your week", "Your progress") the server counts, for each day (Italian time), your searches, the "Refine your taste" decks you complete, the matches you create or vote on in the app, the titles you add and the hearts you give in shared lists, and your wheel spins (with the times you pick the drawn title), plus all-time totals for the badges; it saves points, streak, pauses and the badges you earned with their date. The first time you open your progress, some badges are worked out once from the data you already have (ratings, decks, matches, lists). Friends see your level and the badges you earn only if you both share your activity (section 3.8), never the counts. For the surprises on some days of the year and on the releases you are waiting for, the app saves your phone's time zone on the server (for example "Europe/Rome"), so the day is the right one even if you do not use notifications; we record which surprises we offered you each day, the ones you find and the "Waiting for the holidays" boxes you open, with the three titles of the first box. The lines that hint at a release without naming it are written by the free plan's AI model on Amazon Bedrock in the EU once per title or game and language, the same for everyone and only from catalogue data: they contain no personal data. None of this gives Coins or Premium. Basis: contract.

4. Data that stays on your phone

It does not reach our server, except for what each single request needs and what we save on the linked account (section 3.3.1): preferences (country, services, language, theme), your conversation history (the last 100), "Group night" guests, the request postponed to tomorrow, your consent choices and the day's three titles with their services that the app hands to the "Tonight for you" widget, if you add it to your Home screen. The badges you have already seen also stay on the phone, to mark the new ones. It is deleted when you delete your account in the app or uninstall it.

5. How long we keep data

  • Titles suggested in "Tonight for you" and the days we sent you the evening notification: 7 days; evening notification subscription: until you turn it off or delete your account.
  • Account, watched titles, ratings, "To watch", personal lists, game collection (board and video games), Apple or Google link, search counts and purchased search balance: until you delete your account. When you delete it in the app we remove them from the database immediately.
  • Preferences and conversations on the linked account: while the account stays linked and until you delete them; a deleted conversation leaves the server at the next sync (we keep only its identifier and date for 90 days, to delete it on your other phones too). They are also deleted when you unlink the last provider or delete the account.
  • List of similar title pairs (section 3.2): recomputed every night; it contains no personal data.
  • “Refine your taste” signals, gifted Coin balance and register of gifts: until you delete your account. “Refine your taste” deck outcomes: 30 days.
  • Unused accounts: deleted with all their data after 24 months without use, or 60 months if they still have purchased searches (never with an active Premium subscription).
  • Request text: not stored; cached answers: 10 minutes, deleted by the following night; interpretation of the request in the server's memory: one hour.
  • “What I remember” rules: until you remove them or delete the account. “Search by plot”: the sentence is not stored; cached results 7 days, daily count 2 days. Criteria of answers with few results (“What we can't find”): 30 days, without text and without any link to the account. “Your year on Couchu”: the sentence with its numbers until you delete the account. “Which title is it?”: links, texts and screenshots not stored; daily screenshot count 2 days.
  • Integrity check keys (iPhone): 12 months after last use.
  • Events received from RevenueCat, rewarded video confirmations and unlocks obtained with videos: 90 days.
  • Notification token and alert settings: while alerts are on (Premium alerts, at most 30 days after Premium ends); log of sent alerts: 60 days; months in which we sent you the monthly summary: 13 months; app news notifications sent: 90 days (the token, while the switch stays on); notification receipts (Expo ticket identifier): until the outcome is read, 2 days at most.
  • Stored subscription advice (section 3.2): 6 hours. Fingerprints of Apple or Google tokens already used (section 3.3): until the token expires.
  • Polls and votes: up to 7 days after expiry (48 hours after creation).
  • Trakt link and its encrypted authorisation: until you unlink it or delete the account (imported titles stay like any other watched title). Answer to your partner about using your ratings: until you change it, change partner or delete the account. Record of the “New titles to browse” notifications sent: 60 days.
  • Name, partner link and match, friends and lists notification subscription: until you remove them or delete your account; partner invite codes: 48 hours, then deleted by the nightly cleanup; record of match notifications: until the match is deleted.
  • Friends, shared lists (with titles and hearts), Google account photo and the choice to share your activity: until you remove them, leave the list or delete your account; friend invite codes: 48 hours (at most 10 uses); list codes: 7 days; expired codes are deleted by the nightly cleanup; friends and lists notifications: at most 10 minutes after they were due (8 am, for those held overnight), then one day after they are sent, and then they are deleted.
  • Coins sent and received and Coin requests: 400 days, then deleted in the nightly cleanup (the app shows the last 90 days); Coin debt: until it is covered or you delete your account. Activity counts, points, streak, level, badges, surprises found, "Waiting for the holidays" boxes opened and the saved time zone: until you delete your account; surprises offered each day: 14 days; release surprise lines: not personal data. "Progress" switch: until you turn it off.
  • Server logs: 14 days. Crash reports (Sentry): up to 90 days. Usage statistics (PostHog): up to 12 months.
  • Purchase history at RevenueCat: kept after account deletion too, for 10 years, because it records sales and refunds that we must keep for tax and accounting obligations (Art. 2220 of the Italian Civil Code and Art. 22 of Presidential Decree 600/1973; Art. 17(3)(b) and (e) GDPR). It is linked only to the random account code, which after deletion no longer lets us trace it back to you. Apple and Google keep their own purchase data under their own rules.
  • Encrypted database backups: overwritten on a rotating basis; deleted data may remain in them until the backup expires, without being used.
  • Beta email: until you withdraw consent and in any case no longer than 24 months after signup, then deleted automatically; after withdrawal we delete it within 30 days.

6. Providers and transfers

These providers process data on our behalf as processors, except where stated:

  • Amazon Web Services (region eu-south-1, Milan, Italy): servers, database, logs and Amazon Bedrock models in the EU.
  • Cloudflare: DNS, protection and delivery of the website and the API.
  • RevenueCat: management of subscriptions and purchased searches.
  • Google AdMob: free plan ads and rewarded videos (independent controller for advertising).
  • Sentry: crash reports.
  • PostHog (EU region): usage statistics, only with your consent.
  • Expo: delivery of push notifications and app updates.
  • Apple and Google: optional sign-in, stores, payments, notifications and app integrity checks (independent controllers).

The IP address is also received, as independent controllers, by Movie of the Night when the app or the poll page download posters and logos, and by the Wikimedia Foundation for title searches forwarded to Wikidata (section 3.4). Google receives the IP address of whoever views a Google account photo (section 3.8) or starts a trailer (section 3.7). If you link Trakt, Trakt (United States) receives from our server, as an independent controller, the read requests made with your authorisation (section 3.2). If you import your Steam library, Valve (United States) receives from our server, as an independent controller, the profile link or ID you typed (section 3.2).

Some of these providers are based in the United States and may process technical data outside the European Union: the transfer is covered by the EU-US Data Privacy Framework, where the provider participates in it, or by the European Commission's standard contractual clauses. We do not sell your data to anyone.

7. Your rights

You can ask us at any time to access, correct or delete your data, restrict its processing, receive it in a readable format (portability) or object to processing based on legitimate interest. You can do much of this yourself in the app: Settings › Privacy and data › Export my data (a JSON file with everything the server keeps about your account, including the matches received as a partner, the match and friends and lists notification preferences without the token, the "Tonight for you" titles, the outcomes of the "Refine your taste" decks, the stored subscription advice, your name, partner, friends, shared lists with the date you joined each one and the date each title was added, the Google account photo with your choice, the "App news" switch and log, your answer about your partner using your ratings, the “Your year” sentences, the “New titles to browse” switch and log, and whether Trakt is linked, without its authorisation, the Coins sent and received with the requests and any debt, progress, badges, activity counts, surprises found and "Waiting for the holidays" boxes), Settings › Privacy and data › Delete account, the statistics and alert switches, the "Use my ratings for everyone's recommendations" switch to object to the use of your ratings for recommendations from similar tastes (legitimate interest, Art. 21 GDPR), and Ad consent. In Settings › Partner and friends you correct the name others see, unlink your partner, remove friends, turn off "Share my activity" and withdraw your consent to the photo ("Show my Google account photo") and, in Home partner, your consent to the use of your ratings in “Just us two”; in Settings › Account and plan you unlink Trakt; in Settings › Notifications you turn off each kind of notification. Withdrawing consent does not make the processing carried out before unlawful (Art. 7(3) GDPR). For requests by email write to [email protected] quoting the account code shown in Settings: we answer within one month. See also Delete account.

If you believe the processing breaches the GDPR you can lodge a complaint with your local data protection authority; in Italy this is the Garante per la protezione dei dati personali.

8. Automated decisions

Recommendations are generated automatically, but they only suggest what to watch: we make no automated decisions that produce legal effects on you or similarly significantly affect you (Art. 22 GDPR). The taste profile and the recommendations from similar tastes (section 3.2) are a form of profiling (Art. 4(4) GDPR) that only serves to choose and order the titles we suggest, not to assess you: you can ignore the recommendations, search for titles yourself and object to the use of your ratings for everyone's recommendations.

9. Children

Couchu is meant for people aged 14 or over, the age from which in Italy you can consent to online services on your own (Art. 2-quinquies of the Italian Privacy Code) and use artificial intelligence systems without parental consent (Art. 4 of Law 132/2025). In the other countries of the European Economic Area, the age set by your country for consenting to online services on your own applies, between 13 and 16 (Art. 8 GDPR). If you are younger, you may use it only with a parent's consent. In the stores the app is rated for ages 16 and up.

10. Sources of film and series data

Information about titles is not personal data and comes from external sources we are grateful to:

11. Changes

If we change this policy we update the date at the top; for significant changes we will notify you in the app before they apply.